Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"<Current directory>\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%WINDIR%\AppCompat\Programs\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\WUDFHost.exe", "%WINDIR%\AppCompat\Programs\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\sro_client\firefox.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\WUDFHost.exe", "%WINDIR%\AppCompat\Programs\csrss.exe", "%ProgramFiles%\sro_client\f...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%WINDIR%\PolicyDefinitions\en-US\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%HOMEPATH%\Saved Games\smss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\Users\Public\Downloads\audiodg.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '"%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<Current directory>\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\totalcmd\LANGUAGE\wininit.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\wmiprvsew
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\audiodga
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- <Current directory>\wudfhost.exe
- <Current directory>\cc11b995f2a76d
- C:\totalcmd\language\wininit.exe
- C:\totalcmd\language\56085415360792
- %TEMP%\7avjy2orpa
- %TEMP%\fzbocqhbdj
- %TEMP%\0ob8tzuoid
- %TEMP%\kxzqs3vlhf
- %TEMP%\xpskvvnygf
- %TEMP%\vst98bdswn
- %TEMP%\7gihvqg3b0
- %TEMP%\xk50n8mgsm
- %TEMP%\ufgs6qfsg5
- %TEMP%\kewsm3r4c2
- %TEMP%\o1yetjf6zf
- %TEMP%\9zkrpd5lvf
- %TEMP%\hiv5m3ymot
- %TEMP%\rsdzx2rbix
- %TEMP%\vitk5u3pdt
- <Current directory>\winlogon.exe
- %TEMP%\to1hubxcem
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\9db6e019d4f04e
- %WINDIR%\policydefinitions\en-us\cc11b995f2a76d
- <Current directory>\480b7989c529f6
- %WINDIR%\appcompat\programs\csrss.exe
- %WINDIR%\appcompat\programs\886983d96e3d3e
- %ProgramFiles%\sro_client\firefox.exe
- %ProgramFiles%\sro_client\0fc223bdacedc3
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\56085415360792
- %WINDIR%\policydefinitions\en-us\winlogon.exe
- %WINDIR%\installer\{eb9bd1d5-8dfb-48c4-927b-10bb47ca59b3}\system.exe
- %ProgramFiles%\symantecrootinstaller\24dbde2999530e
- %WINDIR%\installer\{eb9bd1d5-8dfb-48c4-927b-10bb47ca59b3}\27d1bcfc3c54e0
- %HOMEPATH%\saved games\smss.exe
- %HOMEPATH%\saved games\69ddcba757bf72
- C:\users\public\downloads\audiodg.exe
- C:\users\public\downloads\42af1c969fbb7b
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\audiodg.exe
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\42af1c969fbb7b
- %ProgramFiles%\symantecrootinstaller\wmiprvse.exe
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\iexplore.exe
- %TEMP%\vtspyrvvtx
Deletes the following files
- %TEMP%\7avjy2orpa
- %TEMP%\vitk5u3pdt
- %TEMP%\rsdzx2rbix
- %TEMP%\hiv5m3ymot
- %TEMP%\9zkrpd5lvf
- %TEMP%\o1yetjf6zf
- %TEMP%\kewsm3r4c2
- %TEMP%\7gihvqg3b0
- %TEMP%\ufgs6qfsg5
- %TEMP%\vst98bdswn
- %TEMP%\to1hubxcem
- %TEMP%\xpskvvnygf
- %TEMP%\kxzqs3vlhf
- %TEMP%\0ob8tzuoid
- %TEMP%\fzbocqhbdj
- %TEMP%\xk50n8mgsm
- %TEMP%\vtspyrvvtx
Network activity
Connects to
- '87.##1.77.63':80
TCP
HTTP GET requests
- http://87.##1.77.63/cpulongpollflowerpublicCdn.php?xx############################################################################################################################################...
- http://87.##1.77.63/cpulongpollflowerpublicCdn.php?BX############################################################################################################################################...
Miscellaneous
Creates and executes the following
- 'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'
- 'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 14 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Downloads\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONSTART /tr "'C:\Users\Public\Downloads\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 9 /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 14 /tr "'%HOMEPATH%\Saved Games\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONSTART /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 5 /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'<Current directory>\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\SymantecRootInstaller\WmiPrvSE.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONSTART /tr "'%HOMEPATH%\Saved Games\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%HOMEPATH%\Saved Games\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 6 /tr "'%HOMEPATH%\Saved Games\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'<Current directory>\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 7 /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%WINDIR%\AppCompat\Programs\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\sro_client\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\sro_client\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONSTART /tr "'%ProgramFiles%\sro_client\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\sro_client\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 6 /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'%WINDIR%\PolicyDefinitions\en-US\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc MINUTE /mo 12 /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONSTART /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'%WINDIR%\Installer\{EB9BD1D5-8DFB-48C4-927B-10BB47CA59B3}\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\wininit.exe'" /f
